Live › vulnerability › CVE-2026-114095
Go to dashboardDulwich, a pure-Python Git implementation, recurses forever when a packfile contains an OFS_DELTA object pointing at offset 0. An attacker who serves a malicious repository can exhaust CPU during clone, fetch or cat-file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Dulwich to clone, fetch or read Git repositories from sources they do not fully control, such as user-supplied URLs or third-party remotes. Systems that only work with trusted local repositories are less exposed. unknown whether other Dulwich entry points are affected beyond clone, fetch and cat-file.
No product ranges from the sources yet.
pip show dulwich and check whether the version is below 1.2.9dulwich pinned below 1.2.9dulwich to 1.2.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
This page as .md · .json · in your agent: get_signal("CVE-2026-114095")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.